"www." Domain When Adding Website

WebInfra

A very minor UI annoyance when adding a website is the Domain containing "www.":

This may confuse some users who wants to use a subdomain for their website.

Besides that, the usage of "www" in FQDN is in the decline especially with browsers like Chrome no longer showing them.

Perhaps there can be a better way to present this besides showing "www."?

necrom

Agree entirely, I'd prefer it says "https://" and then strip "https://" if the customer enters it, with no mention of www.

That being said, I think we really need to prioritise sub domain-locking above everything else because right now any customer can steal sub-domains from any other customer using the nameservers and get themselves a nice fully SSL signed phishing site, a particular concern if you're hosting your hosting sales website on your hosting control panel... Right now we've had to script a cron API to notify us of every domain and domain alias change to make sure nobody adds login.ourdomain.ext or gmail.com to the cluster.

WebInfra

necrom Personally that's not a major concern for us as we've always allowed customers to do this and we don't have much, if any phishing incident as a result of this. I guess it depends on the type of customer base so I will prefer if this is something which can be toggled so we can decide if we want to enable it.

XN-Matt

necrom You really shouldn't need to do that.

I posted about something similar in https://community.enhance.com/d/333-mail-security-zone-setup. Either the system needs to only add config for domains pointed to it or trusted nameservers. For domains that are moving which need to be added before, some sort of TXT record validation.

Having users with free reign of adding any domain and potentially intercepting mail for it (for common names) is a massive security lapse and one reason we cannot go live with Enhance to customers.

XN-Matt

I agree on this and for the same reasons as webinfra.

That said, in cPanel, the box is freeform and the amount of times we've seen resellers enter www.domain.com which then creates www.www.domain.com.

There must be a better way of doing this. Maybe looking at the input and having a field and if they enter www. strip this out as it'll be created automatically anyway. Which then solves both issues of being a visual oddity and those users who are pre-programmed to enter www everywhere as part of the domain itself.

Adam

XN-Matt There must be a better way of doing this. Maybe looking at the input and having a field and if they enter www. strip this out as it'll be created automatically anyway. Which then solves both issues of being a visual oddity and those users who are pre-programmed to enter www everywhere as part of the domain itself.

I think this is how it was in the early versions of Enhance but it caused a lot of end user confusion and by customer request we added the www prefix to indicate that it's added automatically.

We might add some platform settings around this so that you guys (the hosts) can decide what is best for your users.

XN-Matt I posted about something similar in https://community.enhance.com/d/333-mail-security-zone-setup. Either the system needs to only add config for domains pointed to it or trusted nameservers. For domains that are moving which need to be added before, some sort of TXT record validation.

We're going to add this functionality as a configurable option. The mail routing will be decided based on the MX IP(s) and the customer will not be able to override. There will also be a way to configure proxy MX IPs so that the mail routing can still be set to local if one of those IPs is detected, for customers using external mail filtering services.

We are also adding configurable domain blacklisting. This is likely to come first.